Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-05-26_6de41e01f15b13212c5f63bcdbc220c0_chaos_destroyer_wannacry
-
Size
21KB
-
Sample
240526-z9yjladd86
-
MD5
6de41e01f15b13212c5f63bcdbc220c0
-
SHA1
d4ac37f869e034a76b66dcdb0fdb8a3aa5f9edcb
-
SHA256
9578898ead6b426f3385939c924f75440a408c88a646f2a49d25958da77355ef
-
SHA512
42a256699e8baedb80dc6a7675b88aa85df634b1f3b6e5344a1680a1f99bdbe1cc591aa2d04d6c5f5a77612dc50cf0474f337b8f5be7f6fdb58de3944c3b618b
-
SSDEEP
384:RYenjLLADQDzCzk6KT6V29nOVp91tbeIbRxDG6:gc16Q9nc9bbeIbRxD9
Behavioral task
behavioral1
Sample
2024-05-26_6de41e01f15b13212c5f63bcdbc220c0_chaos_destroyer_wannacry.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_6de41e01f15b13212c5f63bcdbc220c0_chaos_destroyer_wannacry.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\read_it.txt
chaos
Targets
-
-
Target
2024-05-26_6de41e01f15b13212c5f63bcdbc220c0_chaos_destroyer_wannacry
-
Size
21KB
-
MD5
6de41e01f15b13212c5f63bcdbc220c0
-
SHA1
d4ac37f869e034a76b66dcdb0fdb8a3aa5f9edcb
-
SHA256
9578898ead6b426f3385939c924f75440a408c88a646f2a49d25958da77355ef
-
SHA512
42a256699e8baedb80dc6a7675b88aa85df634b1f3b6e5344a1680a1f99bdbe1cc591aa2d04d6c5f5a77612dc50cf0474f337b8f5be7f6fdb58de3944c3b618b
-
SSDEEP
384:RYenjLLADQDzCzk6KT6V29nOVp91tbeIbRxDG6:gc16Q9nc9bbeIbRxD9
-
Chaos Ransomware
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-